Splunk Search

How to write field name in its value

mah
Builder

Hi,

How can I write the name of a field in the value like I have :

test_1test_2test_3
warnerrorcritical

 

I want :

test
test_1 - warn
test_2 - error
test_3 - critical

 

I must do this for unknown fields (by now I have 3 tests but it can be more so it must be variable). 

I thought to foreach command but I don't know how to do it.

Can you help me if this usecase is possible ?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are couple of ways, for example

| makeresults
| eval _raw="test_1	test_2	test_3
warn	error	critical"
| multikv forceheader=1
| table test_*
| foreach test_*
    [eval test=if(isnull(test),"<<FIELD>>"." - ".<<FIELD>>,mvappend(test,"<<FIELD>>"." - ".<<FIELD>>))]
| table test

or

| makeresults
| eval _raw="test_1	test_2	test_3
warn	error	critical"
| multikv forceheader=1
| table test_*
| transpose 0
| eval test=column." - ".'row 1'
| table test
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...